What Are AI Agents?

The Agent Confusion: Why Everyone Defines AI Agents Differently

Search any vendor's website for "AI agent" and you'll find the word attached to everything from a FAQ widget to a fully autonomous system. The market has, as Tray.ai puts it, stretched the term "beyond recognition" — which makes it genuinely hard to know what to buy, build, or trust.

The confusion is real, and it's measurable. A PwC survey of 308 US executives found that 79% of companies report adopting AI agents, yet PwC cautions that many of these claims reflect "excitement about what agentic capabilities could enable — not evidence of widespread transformation." Some tools labeled "agents" are barely more than chatbots with better marketing.

The clearest anchor comes from Anthropic's engineering team, who define agents as systems where LLMs dynamically direct their own processes and tool usage, maintaining control over how they accomplish tasks. In practice, agents are "typically just LLMs using tools based on environmental feedback in a loop" — they plan, call tools, read results, and iterate until the job is done (Anthropic Engineering). That contrasts with workflows, where code — not the model — dictates the path.

Tray.ai compresses the taxonomy into a memorable framework: Agents act, Copilots assist, Chatbots chat. Agents extend your systems by taking action across them. Copilots extend your people by speeding up tasks, but a human still owns the final decision. Chatbots extend your channels by answering and routing.

When you encounter any tool calling itself an "agent," run it through two questions from Tray.ai's decision framework:

• Does this need to act across systems with minimal supervision? If yes, it's an agent.
• Is a human still making the final decision? Then it's a copilot.
• If neither is true, it's a chatbot — regardless of what the sales page claims.

The distinction matters because autonomy carries risk. Security researchers describe agents as "digital insiders" whose privilege accumulates with every task assigned (Zero Networks), and published research has found roughly 26% of agent skills carry at least one vulnerability. As Tray.ai warns: the more autonomy you grant, the stronger your governance needs to be.

That's why SkillzBench is building a free directory that security-scans, version-pins, and sandbox-benchmarks agent skills before they reach your agent — so "what can this agent actually do?" becomes a question with evidence behind it, not a marketing claim.

What AI Agents Actually Do: Roles, Types, and Real Use Cases

So where are agents actually earning their keep? Google Cloud's catalog of real-world use cases — 1,302 deployments across 11 industries — sorts them into six practical types: Customer, Employee, Creative, Code, Data, and Security agents. That taxonomy maps neatly onto where companies are actually spending: PwC's survey of 308 US executives found planned or active agent use concentrated in customer service (57%), sales and marketing (54%), and IT/cybersecurity (53%) over the next six months.

The named deployments back this up. Taiwanese automaker LUXGEN reports its AI chatbot cut human customer service workload by 30%, while automotive supplier Valeo says more than 35% of its code is now AI-generated. Toyota's AI/ML platform eliminated over 10,000 man-hours per year. These are concrete, measurable wins — but they cluster in support, code, and routine data work rather than wholesale reinvention.

Each agent type has a distinct job:

• Customer agents handle service inquiries, resolution routing, and personalized responses — the most mature deployment category.
• Employee and Data agents automate internal workflows, document retrieval, and supply-chain analysis.
• Code agents generate, review, and test software, verifiable through automated tests.
• Creative and Security agents draft content and monitor systems for threats, respectively.

The architecture is also shifting. According to adoption research, 66.4% of implementations now use multi-agent systems — specialized agents working in concert, like a supply chain agent triggering a compliance agent that hands off to a financial forecasting agent. Google Cloud frames this as "AI as an active part of the team, where specialized agents can orchestrate entire workflows."

Here's the reality check, though. PwC's survey data shows that 68% of adopting companies report half or fewer of their employees actually interact with agents in daily work. Many employees use agentic features embedded in enterprise apps for routine speedups — which, as PwC puts it, "stops short of transformation." Broad adoption often reflects excitement about what agents could enable, not evidence that work has been redesigned around them.

For builders equipping agents, this gap matters. An agent is only as capable as the tools and skills it can access — and since roughly 26% of published agent skills carry at least one vulnerability, vetting what you connect matters as much as choosing the agent itself. SkillzBench is building a free directory and MCP connector to let you discover, verify, and test those skills before you deploy them.

The Trust Gap: Autonomy Creates a Security Problem

The more freedom you give an agent, the more it can do for you — and the more damage it can do if something goes wrong. That trade-off sits at the heart of every serious AI agent deployment, and it's the tension Tray.ai captures bluntly: "The more autonomy you grant, the stronger your governance needs to be."

Executives already sense this. PwC's survey of 308 US executives found trust varies sharply by task stakes: 38% trust agents with data analysis, but only 20% trust them with financial transactions. The pattern is intuitive — people accept agents where mistakes are recoverable and resist them where mistakes are expensive.

Security researchers frame the deeper problem: agents behave as "digital insiders" — credentialed actors with accumulating privileges, but designed for functionality rather than security. As Zero Networks puts it, the privilege and autonomy that make agents productive also make them a risk that "scales directly with adoption."

The red-team exercise against McKinsey's Lilli platform illustrates how quickly this can go wrong. According to the documented account, an agent reached the entire production database without authenticating within two hours — tens of millions of chat messages, hundreds of thousands of files, and write access to the system prompts governing behavior for 43,000 consultants, with no log entry.

The risk isn't only in the agents themselves. It's in what we connect them to. Published research found roughly 26% of published agent skills carry at least one vulnerability — and skills are exactly how modern agents get their capabilities. An agent is, as Anthropic's engineers describe it, "just LLMs using tools based on environmental feedback in a loop," which means the tools you hand it define both its power and its attack surface.

The governance gap is measurable:

• 76% of technology leaders say governance is extremely important, yet nearly two-thirds of organizations lack policies to manage AI or detect shadow AI.
• 48% of cybersecurity professionals identify agentic AI and autonomous systems as the most dangerous attack vector.
• 51% of AI-using organizations have already experienced at least one negative consequence.

The emerging consensus is that governance can't live inside the model. NVIDIA's open agent safety platform was built on a common failure pattern — agents circumventing application-layer security to complete assigned tasks — with partners arguing safety must be enforced outside the model by controls the agent cannot bypass.

This is why verification of what an agent can access matters as much as the agent itself. SkillzBench is building exactly this kind of external check for agent skills: security scanning, version pinning to commit SHAs, and sandboxed benchmarking before a skill ever reaches your agent — so trust is earned by evidence, not assumed.

Skills, proven — that's the standard agents will need to meet before the trust gap closes.

How to Start with AI Agents: A Practical Playbook

Knowing where agents excel is only half the battle — the other half is knowing how to adopt them without becoming a cautionary tale. The gap between agent enthusiasm and agent results is where most projects live or die.

Start simple. Anthropic's engineering team found that the most successful implementations used simple, composable patterns, and that optimizing a single LLM call is often enough before reaching for anything more complex. Their core advice: agents belong on open-ended problems where the number of steps is unpredictable and you can't hardcode a fixed path. For everything else, a workflow will do the job more cheaply and more reliably.

That's why Anthropic points to coding and customer support as the strongest starting points — both are verifiable domains where success can be checked objectively, through automated tests or resolution rates. PwC's survey data backs this up: among companies planning or actively deploying agents, customer service leads at 57%, followed by sales and marketing at 54% and IT/cybersecurity at 53%, according to its survey of 308 US executives.

But choose your first use case carefully. Gartner projects that over 40% of agentic AI projects will be canceled by the end of 2027, driven by escalating costs, unclear business value, and inadequate risk controls, as industry analysis reports. The antidote is picking use cases with measurable lift — a before-and-after number you can defend to your CFO, not a vibe.

A practical playbook looks like this:

• Pick one open-ended, verifiable task — code generation, ticket resolution, data analysis — and instrument a baseline before deploying anything.
• Run a pilot, but don't stop there. PwC warns that companies that stop at pilot projects will soon find themselves outpaced by competitors willing to redesign how work gets done.
• Enforce governance outside the model. Safety controls the agent can't bypass are essential, because autonomy and risk scale together.
• Measure lift honestly, then decide whether to expand, fix, or kill — and only then invest in connecting agents across workflows.

If your agents are coding agents, remember that what they can do depends on the skills and tools you give them — and published research has found that roughly 26% of agent skills carry at least one vulnerability. SkillzBench is building a free answer to that: a directory that security-scans, version-pins, and sandbox-benchmarks skills, showing the Lift each one actually delivers, plus a free MCP connector to equip your agents safely.

Start with one task, one baseline, one number. Proven lift beats impressive demos every time.

Equipping Your Agent: Skills, Tools, and How to Choose Them Safely

An agent is only as capable as the tools you hand it. Anthropic's engineers describe agents as "typically just LLMs using tools based on environmental feedback in a loop" — which means the skills and tools you equip an agent with effectively define what it can do (https://www.anthropic.com/engineering/building-effective-agents).

Agent skills are packaged instruction sets — SKILL.md files — that teach agents new capabilities. They work across popular environments like Claude Code, Codex, Cursor, Gemini CLI, and chat-app agents. A skill might teach an agent how to format invoices, run a code review, or pull data from a specific API. Because skills are just text instructions, anyone can write and publish one, and thousands already have.

That openness is both the strength and the risk. Published research found that roughly 26% of agent skills carry at least one vulnerability. A malicious or poorly written skill can instruct an agent to exfiltrate data, bypass guardrails, or take actions you never intended. This matters because agents already act as "digital insiders" whose privilege accumulates with each task — one security analysis notes that the autonomy making agents productive also makes them a risk that scales directly with adoption. And nearly two-thirds of organizations lack policies to manage AI effectively, so unvetted skills often slip through entirely unchecked.

So how do you choose skills safely? Look for these signals before installing anything:

• Verified provenance — every version should be pinned to a specific commit so you know exactly what code you're running.
• Security scanning — skills should be checked for injection patterns, suspicious instructions, and known vulnerabilities.
• Measured impact — does the skill actually improve performance, tested in a sandbox against the same model with and without it?
• License and maintenance status — abandoned or ambiguously licensed skills create legal and reliability risk.

The problem today is that almost no skills come with this information. That's the gap SkillzBench is being built to close: a free, independent directory that continuously discovers skills from GitHub, pins each version, runs security and license checks, and benchmarks every skill in a sandbox to publish its measured Lift in percentage points. A free MCP server then lets you connect only the vetted skills you choose to any agent — with per-agent loadouts so your agent sees exactly what you selected and nothing more.

This aligns with what safety researchers keep emphasizing: governance must be enforced outside the model, with controls the agent can't bypass (https://nvidianews.nvidia.com/news/open-agent-safety-platform). Choosing skills from a verified, benchmarked directory rather than grabbing random files from the internet is exactly that kind of external control.

Equipping an agent well is the difference between a reliable digital coworker and a liability. If you want to be first in line when vetted, benchmarked skills become browsable — and to get alerts as skills are re-scanned and re-tested — join the SkillzBench waitlist. Skills, proven.